High-severity findings.

Audited release

1.6.0

Findings

1

Worst severity

high

Content hash

1c33740673ce45ca2215fc22… Copy

Findings

• high Stored XSS in wp-admin vendor profile and order unhold UI from vendor-controlled fields

  xss_stored

  Vendor-writable user meta is printed into HTML/JS without escaping. dokan_save_vendor_fields / wcfm_save_vendor_fields persist mobbex_entity_uid and mobbex_tax_id from Dokan/WCFM vendor registration and store settings (public signup or logged-in vendor). dokan_admin_add_vendor_fields then echoes those values into input value attributes on show_user_profile/edit_user_profile for any manage_woocommerce user; sanitize_text_field (Dokan path only; WCFM save is unsanitized) does not encode quotes, so a payload like " onfocus="alert(1)" autofocus="x executes when an admin/shop_manager opens the vendor. Separately, add_unhold_fields builds a <select> from split uid/total plus the vendor nickname and interpolates it into var selectStr = '...'; inside an inline script, then assigns via innerHTML. A nickname containing a single quote breaks out of the JS string on the order-edit screen whenever a split is on hold. Both sinks run as the privileged viewer.

  mobbex-marketplace.php:745-763

  Recommendation

  Escape all vendor-controlled values with esc_attr() in HTML attributes and wp_json_encode() / esc_js() when embedding markup in JavaScript. Sanitize on save (sanitize_text_field is not sufficient for attribute/JS contexts). Avoid building HTML in PHP and concatenating it into a JS string; create the select with DOM APIs instead of innerHTML.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.